Excellent write up. This wasn’t a sophisticated attack. Seems like there is very little discipline at Salesforce when it comes to deploying production systems.
This is like saying Apple and Alphabet are the same. SAP is a 52 year old company and is the largest non-American software company in revenue, and has never been part of Salesforce: https://en.wikipedia.org/wiki/SAP